Sending a GET or HEAD request with a body crashes SvelteKit (GHSA-g5m6-hxpp-fc49)

Description

In SvelteKit 2 sending a GET request with a body eg {} to a SvelteKit app in preview or with adapter-node throws Request with GET/HEAD method cannot have body. and crashes the app.

TRACE requests will also cause the app to crash. Prerendered pages and SvelteKit 1 apps are not affected.

<!–

Recommendation

Update the @sveltejs/adapter-node package to the latest compatible version. Followings are version details:

• Affected version(s): **= 4.0.0

  >= 3.0.0, < 3.0.3

  >= 2.0.0, < 2.1.2**

• Patched version(s): **4.0.1

  3.0.3

  2.1.2**

References

• GHSA-g5m6-hxpp-fc49
• CVE-2024-23641
• CWE-20
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Bootstrap Vulnerable to Cross-Site Scripting in its Popover and Tooltip Components - CVE-2025-1647
• Matrix JavaScript SDK's key history sharing could share keys to malicious devices - CVE-2024-47080
• msgpackr's conversion of property names to strings can trigger infinite recursion - CVE-2023-52079
• Trigger `beforeFind` not invoked in internal query pipeline when fetching pointer - CVE-2023-41058

Tags:

npm

@sveltejs/adapter-node